Create Rule From Search

POST 
/api/v1/rules/from-hyperdx

Create a hunt rule from the SQL a Search view renders to.

Wraps the create pipeline with source_type='hyperdx' and auto-derives a unique rule id from the saved-search name, so the caller need not supply one. A view whose SQL the hunt runner could not compile, or that matches every event, is refused with 422. RBAC: rule:write (data_analyst) -- org_viewer has neither this grant nor the UI button.

Request

Responses

201

Successful Response

401

No valid session: the credentials are missing, invalid or expired, or the account behind them is disabled or blocked

403

Refused: the session lacks the action this route checks, or its account must replace an issued password first. A SCIM route answers a refused action in the RFC 7644 error envelope

422

Refused, nothing written. The body failed validation (code validation_error). Or the hunt runner could not compile the rule -- its SQL does not parse as one SELECT, names no <db>.<table> source, names a source that is not a table name (letters, digits, '_' and '-'), has no WHERE to detect with, or calls a function that reads outside the row (url, s3, a dictionary) or sends it to another service (the ai* functions), or carries a CEL filter that does not transpile (code invalid_sql, the errors in sql_errors). Or the rule matches every event in its source (code rule_matches_everything, the source and detection WHERE in context).

default

Problem details (RFC 9457)